MAL-2026-12291

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/twork-data-services-eacq-company-service-v2-api-v1-identifiers-crm/MAL-2026-12291.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12291
Published
2026-08-05T09:13:54Z
Modified
2026-08-05T10:07:03.392329023Z
Summary
Malicious code in twork-data-services-eacq-company-service-v2-api-v1-identifiers-crm (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a35dfc30f1440b5057988bc44c6bdaecee3c33317799c140354ed7adae679838)

index.js unconditionally requires setup.js on module load. setup.js reconstructs C2 hostnames at runtime from split string fragments (resolving to oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, with a DNS-TXT fallback channel under *.dl.well1.site), downloads a platform-specific binary, writes it to a temp path with a masquerading filename (.cache<hex>, dotnetdiag<hex>.exe), chmods 0755, and spawns it detached via /bin/sh -c or cmd.exe with no hash or signature verification. The package's advertised purpose does not require any native binary. Environment variables such as DISABLETELEMETRY, ANALYTICSOPTOUT, and DONOTTRACK are checked to skip execution, consistent with sandbox/analyst evasion. A sibling module lib/telemetry.js, not currently reached from the entrypoint, ships the same spawn(/bin/sh) + chmodSync 0755 + base64-buffer decode pattern with split 'child_'+'process' require, indicating a staged alternate dropper bundled with the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T09:13:54Z",
            "source": "amazon-inspector",
            "sha256": "a35dfc30f1440b5057988bc44c6bdaecee3c33317799c140354ed7adae679838",
            "import_time": "2026-08-05T09:28:29.161772689Z",
            "id": "IN-MAL-2026-014599",
            "versions": [
                "20.6.7"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / twork-data-services-eacq-company-service-v2-api-v1-identifiers-crm

Package

Name
twork-data-services-eacq-company-service-v2-api-v1-identifiers-crm
View open source insights on deps.dev
Purl
pkg:npm/twork-data-services-eacq-company-service-v2-api-v1-identifiers-crm

Affected ranges

Affected versions

20.*
20.6.7

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "twork-data-services-eacq-company-service-v2-api-v1-identifiers-crm-20.6.7.tgz",
            "hashes": {
                "sha512_sri": "sha512-eN/TMtZ4Y8qpefAiRAOe+mJJQW/QrdZFiKvwuELQddPXvIXe3RR7T+Wm7XzT1jUfuD7SUlBSlNgjwNOo8a8vXw==",
                "sha1": "53c0c2ca929c14c7e04d1c45ee2530608a0b00b9"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "56a1b79a12a630198bb0d7e48717541af657e6a33780c6c5fb9c69981f7312483b2efc",
            "sha256": "ec4afc724d346dee431868fab37c529a70c3d03ef83948d26034f4c6751dd2c2",
            "path": "setup.js"
        },
        {
            "tlsh": "f0835055566a202186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "26707172375f685dfc837948d9135214ea8354aa7f3a3ee7f452e28f4d775f5f",
            "path": "lib/telemetry.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/twork-data-services-eacq-company-service-v2-api-v1-identifiers-crm/MAL-2026-12291.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]